Repository navigation
v0.39.3
What's changed
Update the PR timeline straight after a reviewer, label or state change
Seen live in ADO: adding a reviewer or requesting a Copilot review worked,
but the Overview timeline only showed the event after a page reload. Every
successful action dropped the cached feed (invalidatePrPage), but the feed
is its own store and nothing told it to reload, so it kept what it had.
Successful actions now reload the feed at once, and again with the existing
3-second settle refresh (clearing the cache first), because GitHub can add
the timeline event a moment after the mutation returns.
Space the Actions run page's cards and inner tab bars as native Pipelines
Reviewed live in 0.39.2: the Summary card sat flush under the page tab
bar, and the annotations card looked cramped between its Errors/Warnings
tabs and the first row.
Measured with getComputedStyle on native build results pages in
dnceng-public (1400px viewport):
- page tab bar 48px; first card 16px below it; cards 16px apart
- the issues and Stages/Jobs cards are bolt-table-card (no card padding),
16px of top padding, then a 40px large-link tab bar indented 12px - issues: 12px below the tab bar to the first 59px two-line row, no rule
- Stages/Jobs: 16px below the tab bar, then a 1px rule over the graph
Ours before: tab bar to Summary card 0px; annotations card 20px card
padding, a 40px bar holding 48px "tall" tabs that overflowed it by 4px
each side, a 1px rule and rows straight after; Stages/Jobs the same bar.
Ours after: 16px, 16px between cards, and both cards match the native
numbers above (16 + 40 + 12 to the first row; 16 + 40 + 16 + rule).
Both cards now use Card with bolt-table-card and TabBar
tabSize={TabSize.LargeLink}, as native does, in place of CSS height
overrides. The Tests tab's results card shares the annotations card's
class, so it gets the same treatment for consistency (native's Tests tab
has no tabbed card to copy). Nothing hand-rolled.
Give the alert page the Header's own back button, back to the filtered list
The alert detail page had a "Back to dependencies alerts" Link above its
title. Native detail pages use the Header's back button instead, as our
PR page and Branch policies page already do, so the alert title Header
now has backButtonProps with the same label as its tooltip and aria
label, and the link is gone.
The link went back to the bare tab and lost the list's filters. Opening
an alert now keeps the list's filters in the hash (state, severity,
branch, tool, rule, text, ecosystem, package, validity), and the back
button returns to that same hash without the alert, so the list comes
back exactly as it was left. The row's own href is unchanged.
Lay out the alert Details card across its full width, with ids that never break
Reviewed live in 0.39.2: the Details card's label/value list sat in a
narrow column (the card body is a flex row and the list shrank to its
content), so values broke mid-token: "CVE-2026-10 3923",
"package-\nlock.json", ">= 0.11.0, <\n0.18.2".
The card now holds a grid of label-over-value pairs as wide as the card
(auto-fill columns of at least 220px), labels in secondary text. Values
wrap only at spaces; ids, versions and ranges stay on one line, and they
and the manifest path end in an ellipsis with the whole value as the
tooltip if a column is too narrow. A dismissal comment spans the grid,
last. It is the same Details card for Dependabot, code scanning and
secret alerts.
CWE and CVE ids, and a Dependabot alert's GHSA id (new "Advisory" field),
are Links to their advisory pages (NVD, MITRE, GitHub advisories), built
by identifierUrl in lib/securityModel.ts, with tests.
Hand-rolled: the grid is styled divs. azure-devops-ui has no property or
description list component; Link and Pill are the library's.
Shots: security-alert-dependabot, -code and -secret.
Collapse the PR's checks to one row per workflow, with a Checks tab for the rest
Reviewed live in 0.39.2: with many workflows the Overview's policies card
was very tall. Every workflow group (Publish, Dependabot auto-merge,
Storybook Pages, UI screenshots...) was open with every job row, each row
54px, and nothing separated one group from the next.
Why every group was open: a group first seen failing or running was
marked open and then kept that as if the user had chosen it, so it stayed
open after it passed. reconcileOpen (lib/checkGroups.ts) now keeps only
the user's own toggles; an untouched group follows its state, open while
it failed or is running and collapsed otherwise. A toggle still wins,
and a collapsed group that goes from passing to failing still opens. It
takes the rule for untouched groups as a parameter, so the Checks tab can
open everything. Tests cover the running-then-passed case that bit us.
Overview: the summary header and the policy rows as before, then one row
per workflow or app (status, name, Required pill, "3 checks · 1 failed"),
with a 1px rule above each group and "View all checks" at the foot of the
card. Rows are now 45px (were 54-55px). No active pull request in a
public Azure DevOps org was reachable to measure native policy rows, so
this matches native's single-line list rows, measured with
getComputedStyle on Pipelines' Jobs list in dnceng-public (45px), which is
also our Branch policies list's row height (45px). The Re-run buttons now
sit before Details, so Details lines up down the right-hand side.
Checks tab (Overview / Files / Updates / Commits / Checks, hash
prPage=checks): every workflow and job, all open to start, with status,
duration, annotation count, Details and the Re-run buttons. It is the
same Tree, rows and re-run code as the Overview in an "all" mode, not a
copy. Durations come from the check runs' startedAt/completedAt
(checkDurationMs in lib/policies.ts, with tests) and are left off skipped
jobs. A pull request with no checks gets a ZeroData; a failed load an
error MessageCard with Try again.
Mock PR #312 gets job timings and two skipped workflows (Publish with
three jobs, Dependabot auto-merge), so it has seven groups: two failing,
one running. Shots: pr-312 and pr-312-checks.
Components: Tree with ExpandableTreeCell, Status, Pill, Link,
SplitButton, Card, ZeroData, MessageCard, TabBar/Tab. Nothing new is
hand-rolled; the separators are CSS on the Tree's rows.
Keep the alert's severity pill its own width in the Details grid
The new Details grid put the Pill inside a value span; azure-devops-ui's
Pill is a block flex box, so it stretched across the whole 220px column.
It is inline-flex there now, as it was in the old list.
Release 0.39.3
The PR timeline shows reviewer, label, vote and state changes as soon as
they're made; a PR's checks collapse to one row per workflow with a new
Checks tab for the full list; the Actions run page spaces its cards as
native Pipelines does; and alert pages get the Header's back button and a
full-width Details card whose ids and versions never break mid-token.
Full changelog: v0.39.2...v0.39.3